[Security Solution][Detections] adds confirmation modal window for bulk exporting action

x-pack/plugins/security_solution/cypress/integration/detection_rules/bulk_edit_rules.spec.ts

@@ -10,7 +10,6 @@ import {
   CUSTOM_RULES_BTN,
   MODAL_CONFIRMATION_BTN,
   SELECT_ALL_RULES_ON_PAGE_CHECKBOX,
-  LOAD_PREBUILT_RULES_ON_PAGE_HEADER_BTN,
   RULES_TAGS_FILTER_BTN,
   RULE_CHECKBOX,
   RULES_TAGS_POPOVER_BTN,
@@ -29,11 +28,12 @@ import {
   waitForRulesTableToBeLoaded,
   selectAllRules,
   goToTheRuleDetailsOf,
-  waitForRulesTableToBeRefreshed,
   selectNumberOfRules,
   testAllTagsBadges,
   testTagsBadge,
   testMultipleSelectedRulesLabel,
+  loadPrebuiltDetectionRulesFromHeaderBtn,
+  switchToElasticRules,
 } from '../../tasks/alerts_detection_rules';
 
 import {
@@ -105,14 +105,11 @@ describe('Detection rules, bulk edit', () => {
   it('should show warning modal windows when some of the selected rules cannot be edited', () => {
     createMachineLearningRule(getMachineLearningRule(), '7');
 
-    cy.get(LOAD_PREBUILT_RULES_ON_PAGE_HEADER_BTN)
-      .pipe(($el) => $el.trigger('click'))
-      .should('not.exist');
+    loadPrebuiltDetectionRulesFromHeaderBtn();
 
     // select few Elastic rules, check if we can't proceed further, as ELastic rules are not editable
     // filter rules, only Elastic rule to show
-    cy.get(ELASTIC_RULES_BTN).click();
-    waitForRulesTableToBeRefreshed();
+    switchToElasticRules();
 
     // check modal window for few selected rules
     selectNumberOfRules(numberOfRulesPerPage);

x-pack/plugins/security_solution/cypress/integration/detection_rules/export_rule.spec.ts

@@ -5,13 +5,24 @@
  * 2.0.
  */
 
-import { expectedExportedRule, getNewRule } from '../../objects/rule';
+import { expectedExportedRule, getNewRule, totalNumberOfPrebuiltRules } from '../../objects/rule';
 
-import { TOASTER_BODY } from '../../screens/alerts_detection_rules';
+import {
+  TOASTER_BODY,
+  MODAL_CONFIRMATION_BODY,
+  MODAL_CONFIRMATION_BTN,
+} from '../../screens/alerts_detection_rules';
 
-import { exportFirstRule } from '../../tasks/alerts_detection_rules';
+import {
+  exportFirstRule,
+  loadPrebuiltDetectionRulesFromHeaderBtn,
+  switchToElasticRules,
+  selectNumberOfRules,
+  bulkExportRules,
+  selectAllRules,
+} from '../../tasks/alerts_detection_rules';
 import { createCustomRule } from '../../tasks/api_calls/rules';
-import { cleanKibana } from '../../tasks/common';
+import { cleanKibana, deleteAlertsAndRules } from '../../tasks/common';
 import { login, visitWithoutDateRange } from '../../tasks/login';
 
 import { DETECTIONS_RULE_MANAGEMENT_URL } from '../../urls/navigation';
@@ -23,6 +34,7 @@ describe('Export rules', () => {
   });
 
   beforeEach(() => {
+    deleteAlertsAndRules();
     // Rules get exported via _bulk_action endpoint
     cy.intercept('POST', '/api/detection_engine/rules/_bulk_action').as('bulk_action');
     visitWithoutDateRange(DETECTIONS_RULE_MANAGEMENT_URL);
@@ -33,10 +45,45 @@ describe('Export rules', () => {
     exportFirstRule();
     cy.wait('@bulk_action').then(({ response }) => {
       cy.wrap(response?.body).should('eql', expectedExportedRule(this.ruleResponse));
-      cy.get(TOASTER_BODY).should(
-        'have.text',
-        'Successfully exported 1 of 1 rule. Prebuilt rules were excluded from the resulting file.'
-      );
+      cy.get(TOASTER_BODY).should('have.text', 'Successfully exported 1 of 1 rule.');
     });
   });
+
+  it('shows a modal saying that no rules can be exported if all the selected rules are prebuilt', function () {
+    const expectedElasticRulesCount = 7;
+
+    loadPrebuiltDetectionRulesFromHeaderBtn();
+
+    switchToElasticRules();
+    selectNumberOfRules(expectedElasticRulesCount);
+    bulkExportRules();
+
+    cy.get(MODAL_CONFIRMATION_BODY).contains(
+      `${expectedElasticRulesCount} prebuilt Elastic rules (exporting prebuilt rules is not supported)`
+    );
+  });
+
+  it('exports only custom rules', function () {
+    const expectedNumberCustomRulesToBeExported = 1;
+    const totalNumberOfRules = expectedNumberCustomRulesToBeExported + totalNumberOfPrebuiltRules;
+
+    loadPrebuiltDetectionRulesFromHeaderBtn();
+
+    selectAllRules();
+    bulkExportRules();
+
+    cy.get(MODAL_CONFIRMATION_BODY).contains(
+      `${totalNumberOfPrebuiltRules} prebuilt Elastic rules (exporting prebuilt rules is not supported)`
+    );
+
+    // proceed with exporting only custom rules
+    cy.get(MODAL_CONFIRMATION_BTN)
+      .should('have.text', `Export ${expectedNumberCustomRulesToBeExported} Custom rule`)
+      .click();
+
+    cy.get(TOASTER_BODY).should(
+      'contain',
+      `Successfully exported ${expectedNumberCustomRulesToBeExported} of ${totalNumberOfRules} rules. Prebuilt rules were excluded from the resulting file.`
+    );
+  });
 });

x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts

@@ -35,6 +35,8 @@ export const ELASTIC_RULES_BTN = '[data-test-subj="showElasticRulesFilterButton"
 
 export const EXPORT_ACTION_BTN = '[data-test-subj="exportRuleAction"]';
 
+export const BULK_EXPORT_ACTION_BTN = '[data-test-subj="exportRuleBulk"]';
+
 export const FIRST_RULE = 0;
 
 export const FOURTH_RULE = 3;

x-pack/plugins/security_solution/cypress/tasks/alerts_detection_rules.ts

@@ -14,6 +14,7 @@ import {
   DELETE_RULE_ACTION_BTN,
   DELETE_RULE_BULK_BTN,
   LOAD_PREBUILT_RULES_BTN,
+  LOAD_PREBUILT_RULES_ON_PAGE_HEADER_BTN,
   RULES_TABLE_INITIAL_LOADING_INDICATOR,
   RULES_TABLE_REFRESH_INDICATOR,
   RULES_TABLE_AUTOREFRESH_INDICATOR,
@@ -50,6 +51,8 @@ import {
   SELECTED_RULES_NUMBER_LABEL,
   REFRESH_SETTINGS_POPOVER,
   REFRESH_SETTINGS_SWITCH,
+  ELASTIC_RULES_BTN,
+  BULK_EXPORT_ACTION_BTN,
 } from '../screens/alerts_detection_rules';
 import { ALL_ACTIONS } from '../screens/rule_details';
 import { LOADING_INDICATOR } from '../screens/security_header';
@@ -168,6 +171,12 @@ export const loadPrebuiltDetectionRules = () => {
     .should('be.disabled');
 };
 
+export const loadPrebuiltDetectionRulesFromHeaderBtn = () => {
+  cy.get(LOAD_PREBUILT_RULES_ON_PAGE_HEADER_BTN)
+    .pipe(($el) => $el.trigger('click'))
+    .should('not.exist');
+};
+
 export const openIntegrationsPopover = () => {
   cy.get(INTEGRATIONS_POPOVER).click();
 };
@@ -328,3 +337,13 @@ export const mockGlobalClock = () => {
 
   cy.clock(Date.now(), ['setInterval', 'clearInterval', 'Date']);
 };
+
+export const switchToElasticRules = () => {
+  cy.get(ELASTIC_RULES_BTN).click();
+  waitForRulesTableToBeRefreshed();
+};
+
+export const bulkExportRules = () => {
+  cy.get(BULK_ACTIONS_BTN).click();
+  cy.get(BULK_EXPORT_ACTION_BTN).click();
+};

x-pack/plugins/security_solution/public/detections/components/rules/rule_actions_overflow/index.tsx

@@ -28,6 +28,7 @@ import type { Rule } from '../../../containers/detection_engine/rules';
 import {
   executeRulesBulkAction,
   goToRuleEditPage,
+  bulkExportRules,
 } from '../../../pages/detection_engine/rules/all/actions';
 import * as i18nActions from '../../../pages/detection_engine/rules/translations';
 import * as i18n from './translations';
@@ -108,7 +109,7 @@ const RuleActionsOverflowComponent = ({
               onClick={async () => {
                 startTransaction({ name: SINGLE_RULE_ACTIONS.EXPORT });
                 closePopover();
-                await executeRulesBulkAction({
+                await bulkExportRules({
                   action: BulkAction.export,
                   onSuccess: noop,
                   search: { ids: [rule.id] },

x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/actions.ts

@@ -16,8 +16,8 @@ import type { UseAppToasts } from '../../../../../common/hooks/use_app_toasts';
 import { METRIC_TYPE, TELEMETRY_EVENT, track } from '../../../../../common/lib/telemetry';
 import { downloadBlob } from '../../../../../common/utils/download_blob';
 import type {
-  BulkActionResponse,
   BulkActionSummary,
+  BulkActionResponse,
 } from '../../../../containers/detection_engine/rules';
 import { performBulkAction } from '../../../../containers/detection_engine/rules';
 import * as i18n from '../translations';
@@ -34,19 +34,39 @@ export const goToRuleEditPage = (
   });
 };
 
-interface ExecuteRulesBulkActionArgs {
+type OnActionSuccessCallback = (
+  toasts: UseAppToasts,
+  action: BulkAction,
+  summary: BulkActionSummary
+) => void;
+
+type OnActionErrorCallback = (toasts: UseAppToasts, action: BulkAction, error: HTTPError) => void;
+
+interface BaseRulesBulkActionArgs {
   visibleRuleIds?: string[];
-  action: BulkAction;
   toasts: UseAppToasts;
   search: { query: string } | { ids: string[] };
   payload?: { edit?: BulkActionEditPayload[] };
-  onSuccess?: (toasts: UseAppToasts, action: BulkAction, summary: BulkActionSummary) => void;
-  onError?: (toasts: UseAppToasts, action: BulkAction, error: HTTPError) => void;
+  onError?: OnActionErrorCallback;
   onFinish?: () => void;
+  onSuccess?: OnActionSuccessCallback;
   setLoadingRules?: RulesTableActions['setLoadingRules'];
 }
 
-export const executeRulesBulkAction = async ({
+interface RulesBulkActionArgs extends BaseRulesBulkActionArgs {
+  action: Exclude<BulkAction, BulkAction.export>;
+}
+interface ExportRulesBulkActionArgs extends BaseRulesBulkActionArgs {
+  action: BulkAction.export;
+}
+
+// export bulk actions API returns blob, the rest of actions returns BulkActionResponse object
+// hence method overloading to make type safe calls
+export async function executeRulesBulkAction(args: ExportRulesBulkActionArgs): Promise<Blob | null>;
+export async function executeRulesBulkAction(
+  args: RulesBulkActionArgs
+): Promise<BulkActionResponse | null>;
+export async function executeRulesBulkAction({
   visibleRuleIds = [],
   action,
   setLoadingRules,
@@ -56,28 +76,66 @@ export const executeRulesBulkAction = async ({
   onSuccess = defaultSuccessHandler,
   onError = defaultErrorHandler,
   onFinish,
-}: ExecuteRulesBulkActionArgs) => {
+}: RulesBulkActionArgs | ExportRulesBulkActionArgs) {
+  let response: Blob | BulkActionResponse | null = null;
   try {
     setLoadingRules?.({ ids: visibleRuleIds, action });
 
     if (action === BulkAction.export) {
-      const response = await performBulkAction({ ...search, action });
-      downloadBlob(response, `${i18n.EXPORT_FILENAME}.ndjson`);
-      onSuccess(toasts, action, await getExportedRulesCounts(response));
+      // on successToast for export handles separately outside of action execution method
+      response = await performBulkAction({ ...search, action });
     } else {
-      const response = await performBulkAction({ ...search, action, edit: payload?.edit });
+      response = await performBulkAction({ ...search, action, edit: payload?.edit });
       sendTelemetry(action, response);
       onSuccess(toasts, action, response.attributes.summary);
-
-      return response;
     }
   } catch (error) {
     onError(toasts, action, error);
   } finally {
     setLoadingRules?.({ ids: [], action: null });
     onFinish?.();
   }
-};
+  return response;
+}
+
+/**
+ * downloads exported rules, received from export action
+ * @param params.response - Blob results with exported rules
+ * @param params.toasts - {@link UseAppToasts} toasts service
+ * @param params.onSuccess - {@link OnActionSuccessCallback} optional toast to display when action successful
+ * @param params.onError - {@link OnActionErrorCallback} optional toast to display when action failed
+ */
+export async function downloadExportedRules({
+  response,
+  toasts,
+  onSuccess = defaultSuccessHandler,
+  onError = defaultErrorHandler,
+}: {
+  response: Blob;
+  toasts: UseAppToasts;
+  onSuccess?: OnActionSuccessCallback;
+  onError?: OnActionErrorCallback;
+}) {
+  try {
+    downloadBlob(response, `${i18n.EXPORT_FILENAME}.ndjson`);
+    onSuccess(toasts, BulkAction.export, await getExportedRulesCounts(response));
+  } catch (error) {
+    onError(toasts, BulkAction.export, error);
+  }
+}
+
+/**
+ * executes bulk export action and downloads exported rules
+ * @param params - {@link ExportRulesBulkActionArgs}
+ */
+export async function bulkExportRules(params: ExportRulesBulkActionArgs) {
+  const response = await executeRulesBulkAction(params);
+
+  // if response null, likely network error happened and export rules haven't been received
+  if (response) {
+    await downloadExportedRules({ response, toasts: params.toasts, onSuccess: params.onSuccess });
+  }
+}
 
 function defaultErrorHandler(toasts: UseAppToasts, action: BulkAction, error: HTTPError) {
   // if response doesn't have number of failed rules, it means the whole bulk action failed
@@ -130,6 +188,18 @@ function defaultErrorHandler(toasts: UseAppToasts, action: BulkAction, error: HT
   toasts.addError(error, { title, toastMessage });
 }
 
+const getExportSuccessToastMessage = (succeeded: number, total: number) => {
+  const message = [i18n.RULES_BULK_EXPORT_SUCCESS_DESCRIPTION(succeeded, total)];
+
+  // if not all rules are successfully exported it means there included prebuilt rules
+  // display message to users that prebuilt rules were excluded
+  if (total > succeeded) {
+    message.push(i18n.RULES_BULK_EXPORT_PREBUILT_RULES_EXCLUDED_DESCRIPTION);
+  }
+
+  return message.join(' ');
+};
+
 async function defaultSuccessHandler(
   toasts: UseAppToasts,
   action: BulkAction,
@@ -141,7 +211,7 @@ async function defaultSuccessHandler(
   switch (action) {
     case BulkAction.export:
       title = i18n.RULES_BULK_EXPORT_SUCCESS;
-      text = i18n.RULES_BULK_EXPORT_SUCCESS_DESCRIPTION(summary.succeeded, summary.total);
+      text = getExportSuccessToastMessage(summary.succeeded, summary.total);
       break;
     case BulkAction.duplicate:
       title = i18n.RULES_BULK_DUPLICATE_SUCCESS;